{"Id":"181b89e5-4bdd-4e95-b1bc-a294a4adfb29","Tags":["mhyprotrpg.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-07-22","MitreID":"T1068","CVE":[""],"Category":"vulnerable driver","Commands":{"Command":"","Description":"Confirmed vulnerable driver from Microsoft Block List","OperatingSystem":"Windows","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"],"Detection":[{"type":"","value":""}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"851be1f42dc892ce408034b98dc035bb","SHA1":"f631f67d11f2b06c0b3b0c7286997f2f7f538231","SHA256":"8ecd15521b2c37d2ff02a138700007f2aff28a0accfa6fb3480a4421194ef7d2"},"Company":"","Copyright":"©COGNOSPHERE","CreationTimestamp":"2021-12-20 23:33:43","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["NtQuerySystemInformation","RtlInitUnicodeString","ExAllocatePool","ExFreePoolWithTag","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoGetCurrentProcess","_wcsicmp","RtlInitString","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","IoGetDeviceObjectPointer","ZwClose","MmIsAddressValid","ZwOpenDirectoryObject","ZwQueryDirectoryObject","ObReferenceObjectByName","ZwQuerySystemInformation","__C_specific_handler","MmHighestUserAddress","IoDriverObjectType","KeQueryTimeIncrement","KeStackAttachProcess","KeUnstackDetachProcess","PsGetProcessWow64Process","PsGetProcessPeb","MmUnlockPages","MmGetSystemRoutineAddress","MmUnmapLockedPages","IoFreeMdl","ZwTerminateProcess","PsGetProcessImageFileName","ZwQueryObject","ObOpenObjectByPointer","PsReferenceProcessFilePointer","IoQueryFileDosDeviceName","MmProbeAndLockPages","PsLookupProcessByProcessId","MmMapLockedPagesSpecifyCache","IoAllocateMdl","MmCopyVirtualMemory","KeClearEvent","KeSetEvent","KeWaitForSingleObject","MmMapLockedPages","ObReferenceObjectByHandle","PsSetCreateProcessNotifyRoutineEx","PsSetCreateThreadNotifyRoutine","PsRemoveCreateThreadNotifyRoutine","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","ExEventObjectType","ObRegisterCallbacks","ObUnRegisterCallbacks","ObGetFilterVersion","PsGetProcessId","IoThreadToProcess","strcmp","PsProcessType","PsThreadType","RtlEqualUnicodeString","RtlGetVersion","ObfReferenceObject","ObGetObjectType","ExEnumHandleTable","ExfUnblockPushLock","PsAcquireProcessExitSynchronization","PsReleaseProcessExitSynchronization","_snprintf","vsprintf_s","ZwCreateFile","ZwWriteFile","PsLookupThreadByThreadId","NtQueryInformationThread","PsGetThreadProcess","KeDelayExecutionThread","KdDisableDebugger","KdChangeOption","PsCreateSystemThread","PsTerminateSystemThread","KdDebuggerEnabled","PsGetVersion","KeInitializeEvent","RtlCopyUnicodeString","ObfDereferenceObject","ExReleaseFastMutex","ExAcquireFastMutex","MmBuildMdlForNonPagedPool","WdfVersionBindClass","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass"],"Imports":["ntoskrnl.exe","WDFLDR.SYS"],"InternalName":"","MD5":"214a9aba01ee1ba067b2feb382748c16","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"ffdf660eb1ebf020a1d0a55a90712dfb","SHA1":"3e905e3d061d0d59de61fcf39c994fcb0ec1bab3","SHA256":"2b3f99a94b7a7132854be769e27b331419c53989ef42f686d6f5ba09ddefefd6"},"SHA1":"6aa92733aa7b654c3ead8c0a5e81a6b05cbaaeb0","SHA256":"8bf84bed9b5fa4576182c84d2f31679dc472acd0f83c9813498e9f71ed9fef3e","Sections":{".text":{"Entropy":6.1564610880161785,"Virtual Size":"0x6b90"},".rdata":{"Entropy":4.743890654521716,"Virtual Size":"0x152c"},".data":{"Entropy":0.807954115503613,"Virtual Size":"0x15f8"},".pdata":{"Entropy":7.775990038700175,"Virtual Size":"0x660"},"PAGE":{"Entropy":5.569158564506279,"Virtual Size":"0xb0e"},"INIT":{"Entropy":5.377222505619038,"Virtual Size":"0xeae"},".upx0":{"Entropy":7.112913211325938,"Virtual Size":"0x139aa4"},".reloc":{"Entropy":3.978614618281868,"Virtual Size":"0xc4"},".rsrc":{"Entropy":2.939036234999509,"Virtual Size":"0x260"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2021-09-09 19:15:59","ValidTo":"2022-09-01 19:15:59","Signature":"1757782e797188079911866d54bd474a2432707984658c549a407e7fb4e5efa2ba72367a02b382d2116d4c4538836ddcd4616fcd231229df1ae5d0da6b3abe499ee5d8b47a7919940f6bbcbe2575018dca65eef4913e3d38410f2cd6cca3082d9ba2c061173cd828635665f76e8f0f685e03da24290b9d2cae7039da974de7b7e85798ba64cbe9ba34e0308c3bd6b4d68e9723fde74274fd3806fe799d04d6a3835f82d4fefc52088ccda4b4c817116f2f5a99445a3e952d78bc27753e65e97c6271c71ac7c9e3439b847e8984ab06a5904d150223f9ca92bbda86c02663c3f4964da5e106619b6eaff2768143cce9e5a8b0b2cba90e82cd87866d9fd6499c6cfbc96529a18b5653d12b54a6c928693a4e3d197ffbfcce7ed71a909b18d09b4345b24bc25eb8dfa1821a9cd0971ffc7d38a26580e2f118c4ac55bf926d0666b72ad7ba6ec20f0b54d694bc3b8a0dbddda27bd64194da085319841d1ebc9dc067ef72ea064a475bea865828b13077bc8e14e2f7544b90f0045f3cd84bcc0d5a80645a6fb65528e4f768ec775bdb0225399f3c81c0b667714676d0949f9ffaddc8549dc45e5ce4345c4ea7dc0aff4ac510f5527ad94a2181edc4b73bcfde813a83d81ca897854c98712346001a12e5d3bf9a45c807f9b3c7d3e0bb99c035ea54ee39e2c9af4147dbea7aabec85b47192b945e083ddf6061afb901e83b11135d24e","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000004de597a775e3157f7b00000000004d","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"9f0782e89bd41cdd96ec55357457478a","SHA1":"35c2180572baad19019acca1334e6c653699c389","SHA256":"50814710213afec410f26e573d25267a2e21d3d15f158be8a43a666c9cc6fa08","SHA384":"8d48f066b0284071d64bbc556e018824a8388ccd142a56c7b7b04ef6d27cade07da57ac82d8067e18ad64d35af11e2a7"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000004de597a775e3157f7b00000000004d","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"Imphash":"ebb99842fa08915eb8b7f67d8dc7a13a","LoadsDespiteHVCI":"FALSE"}]}